Munger Decision Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.2.4

Overview

This is a Chinese-language Munger mental-model decision helper with quality and dependency concerns, but I found no hidden execution, exfiltration, persistence, or privilege abuse.

Install only if you want a Chinese-language decision-analysis helper and treat investment or allocation suggestions as educational prompts, not financial advice. The publisher should fix missing data files, align examples with code behavior, and refresh vulnerable dev dependencies before relying on it in CI or development workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (61)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence

Finding

handlebars 4.7.8 has a long history of real vulnerabilities, including prototype pollution and code/script injection issues when compiling or rendering attacker-controlled templates. Although present here through ts-jest as a development dependency rather than explicit runtime usage, templating-engine flaws are serious because they can lead to code execution, XSS in generated outputs, or compromise of developer/CI environments if untrusted templates are processed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a user-facing decision-support assistant. The supplied code chunk does not implement any such behavior; it only sets up Jest testing for TypeScript files in a Node environment. This is a materially different primary purpose and unrelated to the declared functionality, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an interactive decision-support skill that analyzes user decisions and recommends relevant mental models. The supplied code does not perform any user-facing analysis or recommendations. Instead, it is a data preparation script that parses markdown files from a local models directory, extracts model fields, and outputs a JSON file. This is a materially different primary purpose. Although generating model data could support the skill internally, this specific code chunk itself implements content conversion and local file I/O capabilities that are not reflected in the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes an end-user assistant for analyzing decision scenarios and recommending mental models. The supplied code does not implement scenario analysis, model recommendation, structured guidance, or any user-facing decision-support logic. Instead, it is a build/data-preparation script that processes local JSON files and generates model content entries. This is a materially different primary purpose and includes undeclared filesystem-based content generation capabilities unrelated to the declared assistant behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an interactive decision-support skill for users. The supplied code does not implement any user-facing decision analysis or recommendation flow. Instead, it is an offline utility script for preprocessing a library of mental models: it loads model data from disk, replaces or improves descriptions from a hardcoded knowledge base, generates canned guiding questions and keywords, and saves the result to another file. This is a materially different primary purpose. Additionally, the code uses local filesystem read/write operations, which are not reflected in the declared permissions. Therefore the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents an assistant that evaluates a decision situation and recommends appropriate mental models for investment, product, strategy, or life decisions. The code shown does not perform scenario analysis, inference, ranking, or guided decision support. Instead, it is a simple data access layer over a JSON file of models. Its recommend method merely maps provided model IDs to stored records, which is materially different from intelligently recommending models based on a user's scenario. This is a substantive purpose/behavior mismatch, though the general domain (Munger mental models) is consistent.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

brace-expansion 2.0.2 has multiple reported denial-of-service issues involving pathological expansion input that can trigger extreme CPU or memory consumption. Even though this instance is transitive and primarily part of tooling, vulnerable glob/pattern parsing libraries are often exposed indirectly during test, build, or file-matching operations when given attacker-controlled patterns.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

browserslist 4.28.1 is reported vulnerable to crashes, prototype write behavior, and unbounded memory growth when handling untrusted stats/query data. In this repository it is a development dependency chain, so it is less dangerous than a runtime parser exposed to end users, but still represents a real risk in CI/build environments that ingest external configuration or project files.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

js-yaml 3.14.2 is associated with CPU-exhaustion and parser abuse issues on crafted YAML documents. That is a genuine vulnerability class for parser libraries; here it is only a transitive dev dependency, which lowers immediate exposure, but it remains relevant if any tooling in the repository parses attacker-supplied YAML during CI, testing, or local development.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/smart-recommender.ts (reported line 225)May include surrounding context.

ts

hiring: { '08': 15, '06': 10, '45': 15 },
      strategy: { '08': 20, '07': 20, '09': 15 }
    };
    return rules[scenarioId]?.[modelId] || 0;
  }
  
  /**

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/smart-recommender.ts (reported line 333)May include surrounding context.

ts

hiring: { '08': 15, '06': 10, '45': 15 },
      strategy: { '08': 20, '07': 20, '09': 15 }
    };
    return rules[scenarioId]?.[modelId] || 0;
  }
  
  /**

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill README is written only in Chinese, including installation and usage instructions, with no indication that other languages are supported or that the Chinese-only presentation is an intentional, justified regional limitation. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The primary skill title and descriptive content are written in Chinese, while the manifest description above is in English, and there is no indication that users may choose their preferred language. This creates a natural-language policy concern because the skill appears to impose a specific locale/language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's console output, test prompt, and all simulated user answers are written in Chinese, indicating the skill is designed to operate in a fixed language context. There is no visible opt-in, language selection, or documentation in this file justifying a mandatory Chinese-only interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructional content in Chinese and does not indicate that the user can choose another language or that the Chinese-only format is intentional for a specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

AllocationScenario declares INVESTMENT_CRYPTO and RELATIONSHIP as supported scenarios, suggesting the calculator handles them. However, the allocation matrices only define INVESTMENT_STOCK, CAREER_MOVE, LEARNING_TIME, and BUSINESS_VENTURE (L0921-L0954, L1617-L1646), so these documented enum options are not actually implemented and would not resolve in the matrix.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The sample output says an assessment at level L3_PREDICT with confidence 78 yields 'PROCEED_WITH_CAUTION' and a 50% max allocation. But the implemented ActionAdvisor logic returns PROCEED for L3_PREDICT when confidenceScore >= 70 (L0776-L0778, L1553-L1555), and ACTION_METADATA defines PROCEED as maxPosition 1.0 / 100% (L0689-L0701). This is an active contradiction between documentation and code behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example output states '最大投入：20%' for an L3 investment case, but AllocationCalculator.getMaxAllocation returns 0.50 for all L3_PREDICT cases regardless of scenario (L0979-L0987, L1660-L1668). Since calculate() exposes that value as maxAllocation (L0908-L0910, L1605-L1612), the documented result conflicts with actual code output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script expects markdown sections with Chinese headings and emits fallback questions and scoring labels only in Chinese. This imposes a specific language/locale behavior without user opt-in or documentation of a justified locale constraint, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language comments and console output in Chinese, and the generated content strings are also Chinese-only. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is clearly justified or optionality is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This TypeScript file contains user-facing and developer-facing natural-language content entirely in Chinese, including the header comment and generated code comments/reason strings. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JavaScript file contains natural-language comments and console output in Chinese, including the primary description of the script's purpose. Because the file does not offer a language option or document that the skill is intentionally region-specific, it conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This TypeScript file's natural-language content, including the class description and usage examples, is presented exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This codebase presents its primary description and user-facing interaction flow entirely in Chinese, and the returned messages throughout the file also assume Chinese output. That creates a language/locale policy concern because the skill appears to force a specific language without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The report formatter hard-codes the locale zh-CN and emits fixed Chinese headings such as 决策分析报告, which enforces a specific language/locale for output. This matches the policy-violation category because users are not given an opt-in or alternative locale, and no region-specific justification is documented in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.